CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11032 – SQL injection on addme_observer and addme_assign in GLPI
https://notcve.org/view.php?id=CVE-2020-11032
In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6. En GLPI versiones anteriores a 9.4.6, se presenta una vulnerabilidad de inyección SQL para todas las instancias del helpdesk. Una explotación de esta vulnerabilidad requiere una cuenta de técnico. • https://github.com/glpi-project/glpi/security/advisories/GHSA-344w-34h9-wwhh • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-14666
https://notcve.org/view.php?id=CVE-2019-14666
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes. GLPI versiones hasta 9.4.3, es propenso a la toma de control de cuentas mediante el abuso de la funcionalidad autocompletion del archivo ajax/autocompletion.php. • https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13240
https://notcve.org/view.php?id=CVE-2019-13240
An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address. Se detectó un problema en GLPI versiones anteriores a 9.4.1. Después de que un usuario haya restablecido con éxito la contraseña, es posible cambiarla de nuevo durante las próximas 24 horas sin ninguna información, excepto la dirección de correo electrónico asociada. • https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7 https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6 https://github.com/glpi-project/glpi/compare/1783b78...8e621f6 https://github.com/glpi-project/glpi/releases/tag/9.4.1 https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13239
https://notcve.org/view.php?id=CVE-2019-13239
inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. inc/user.class.php en GLPI en versiones anteriores a la 9.4.3 permite Cross-Site Scripting (XSS) mediante una imagen de usuario. • https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb https://github.com/glpi-project/glpi/releases/tag/9.4.3 https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-10477
https://notcve.org/view.php?id=CVE-2019-10477
The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions. El plugin "FusionInventory", en versiones anteriores a la 1.4 para GLPI 9.3.x y en las anteriores a la 1.1 para GLPI 9.4.x, gestiona de manera incorrecta las acciones sendXML. • https://github.com/fusioninventory/fusioninventory-for-glpi/commit/0f777f85773b18f5252e79afa1929fcdc4858c3a https://github.com/fusioninventory/fusioninventory-for-glpi/compare/260a864...e1f776d https://github.com/fusioninventory/fusioninventory-for-glpi/compare/cec774a...baa4158 https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.3%2B1.4 https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.4%2B1.1 • CWE-19: Data Processing Errors •